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REMARKS/ ARGUMENTS 

In the specification, the Abstract and pages 6 and 7 have been amended to address the 
objections thereto on page 2 of the Office Action. In particular, the Abstract has been revised, 
and now is within the range of 50 to ISO words. The disclosure has been amended to delete the 
embedded hyperlinks from page 7. As amended, page 7 refers to an organization Scorn which the 
referenced documents are available, instead of to its website. 

Claims 1 to 4, 12 to 13, 18 to 23, 31 to 32, 37 to 39, 43 to 46, 48 to 49, and 52 were 
rejected under 35 U.S.C. 102(e) as being anticipated by Asad et al (United Slates Patent 
No. 6,725,240). 

In respect of independent claims 1, 37, and 46, page 3 of the Office Action states that 
Asad et at. discloses a method of performing remote notification of records, each having a record 
identifier, the method comprising; maintaining a record-user mapping which associates with 
each of the plurality of record identifiers a respective one or more user names, for each record 
upon which remote notification is to be performed obtaining the record's record identifier's 
respective one or more user names from the record-user mapping, for each user name in the 
record's record identifier's respective one or more user names obtaining from a user name- 
addressable entity mapping a respective addressable entity and sending a notification of the 
record to the addressable entity. According to the Office Action, these features arc disclosed at 
column 5 lines 19-67, column 6 lines 1 to 12 and 22 to 45, column 7 lines 29 to 67, column 8 
lines 1 to 26, and Figures 4 and 5 of Asad et al. 

However, it is respectfully submitted that Asad et at. fails to disclose performing remote 
notification of records based on a record-user mapping or a user name-addressable entity 
mapping, as recited in these independent claims. With reference, for example, to column 5 lines 
48 to 52 and Figure 4 of Asad et al., audit clients 402 and 404 are merely collectors of events 
which arc sent to the audit servers 406 and 412. The audit servers 406 and 41 2 collect the events 
from the audit clients 402 and 404 into an audit database 410. There is no teaching or suggestion 
in Asad el aL that the audit clients 402 and 404 have any capability for selective forwarding of 
events based on a record-user mapping or a user name-addressable entity mapping, as recited in 
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each of claims 1, 37, and 46. Asad et aL also lacks any discussion of the audit servers 406 and 
412 performing subsequent distribution or notification of audit records based on any such 
mappings. The audit servers 406 and 412 merely collect events into an audit database. 

In regard to the sending of events to the audit servers 406 and 412 by the audit clients 402 
and 404, it is noted that record identifiers are assigned by the audit servers 406 and 412 and not 
by the audit clients 402 and 404. Accordingly, the operation of the audit clients 402 and 404 to 
send events to the audit servers 406 and 412 cannot reasonably be construed as performing 
remote notification of records each having a respective record identifier 7 *, since the record 
identifiers would not yet have been assigned when events are sent by the audit clients 402 and 
404 to the audit servers 406 and 41 2. 

Asad et aL also fails to disclose or suggest the operation of obtaining one or more user 
names associated with a record identifier from a record-user mapping. Although the audit log 
table 530 shown in Figure 5 includes a row for each event received from an audit client and 
columns for a serial number and an authorized entity, Asad et aL provides absolutely no teaching 
of obtaining an authorized entity from the audit log table for the purposes of performing remote 
notification of an event or record. 

There is also no disclosure in Asad et aL of the claimed feature of obtaining from a user 
name-addressable entity mapping a respective addressable entity. Again, although Figure 5 of 
Asad et aL shows an authorized entity table 550, which it is believed has been interpreted as 
being equivalent to a user name-addressable entity mapping, no teaching of obtaining a 
distinguished name which corresponds to an authorized entity stored in the audit log table 530 
has been provided in Asad et at. 

Asad et aL also fails to disclose the operation of sending a notification of a record to an 
addressable entity obtained from a user name-addressable entity mapping. 

Clearly, Asad el aL fails to disclose performing remote notification of records as recited 
in the independent claims 1, 37, and 46. At least the above claimed features patentably 
distinguish these claims over Asad et aL 
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The rejected dependent claims 2 to 4, 12 to 13, 18 to 19, 38 to 39, 43 to 45, 48 to 49, and 
52 all depend from one of the independent claims 1 , 37, and 46 and thus similarly distinguish 
over Asad et aL for at least the above reasons. 

The dependent claim 13 includes additional features which have not been disclosed in 
Asad et al. This claim recites record reading parameters which determine circumstances under 
which a new set of records for processing is to be obtained, and obtaining the new set of records 
for processing in accordance with the record reading parameters. From page 4 of the Office 
Action, it is apparent that the application programming interface disclosed in Asad et aL has been 
interpreted as being equivalent to "circumstances under which the new set of records for 
processing is to be obtained". It is respectfully submitted that an API is not equivalent to such 
"circumstances" An example of the claimed record reading parameters is provided at page 9 
line T7 to page 10 line 2 of the specification of the instant application, which describes 
"information identifying how often the remote notification tool 1 8 should query the audit record 
repository 14 for new audit records for processing for remote notification". This type of 
parameter would not be part of an API, and accordingly Asad et aL does not disclose record 
reading parameters which determine circumstances under which a new set of records for 
processing is to be obtained, as recited in claim 1 3. 

In respect of claims 18 to 20, 44, and 45, the Office Action states on page 4 that 
Asad et aL discloses identifying at least one record identifier for which target audit record 
processing is to be performed, the target audit record processing comprising: for each record 
identifier for which target audit record processing is to be performed reading fiom the associated 
record a target user name, obtaining from the user name-addressable entity mapping a respective 
addressable entity for the target user name and sending a notification of the record to the 
addressable entity. The Office Action refers to column 8 lines 53 to 67 and column 9 lines 1 to 
27 as supposedly disclosing these features. 

Referring to these passages of Asad et aL, an audit record creation process is described, in 
which an audit client from which an event is received is notified of any of various failures in the 
audit record creation process. However, the audit record creation process does not involve 
reading a target user name from a record, obtaining from a user name-addressable entity mapping 
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a respective addressable entity for the target user names, or sending a notification of the record to 
the addressable entity. Notifications of failures are provided to an audit client from which event 
is received. There i$ no teaching in Asad et at. of reading a target user name from a record or 
obtaining an addressable entity to which a notification of the record is to be sent. Failure 
notifications are sent only to an audit client, and not to an addressable entity associated with a 
target user name specified in an audit record 

At least the above features recited in claims 18 to 20, 44, and 45 have not been disclosed 
in Asad et ah The rejected dependent claims 21 to 23 and 31 to 32 depend from independent 
claim 20 and thus similarly distinguish over the cited reference. Claim 32 also depends from 
claim 20 and recites the additional features of record reading parameters, which further 
distinguish the claim over the cited reference substantially as described above with reference to 
claim 13. 

It is therefore respectfully submitted that claims 1 to 4, 12 to 13, 1 8 to 23, 31 to 32, 37 to 
39, 43 to 46, 48 to 49, and 52 are not anticipated by Asad et a/., which fails to disclose or suggest 
at least the above features. Reconsideration and withdrawal of the rejection of these claims 
under 35 IIS.C. 102(e) as being anticipated by Asad et aL are respectfully requested. 

The remaining claims 5 to 1 1, 14 to 1 7, 24 to 30, 33 to 36, 40 to 42, 47, 50 to 5 1 , and 53 
to 55 were rejected under 35 U.S.C. 103(a) as being unpatentable over Asad et aL in view of 
Bisbec et aL (United States Patent No. 6,367,013). 

However, it is respectfully submitted that a. prima facie case of obviousness has not been 
established in respect of these claims, since the cited references do not disclose all of the claimed 
features, and there is no motivation to combine the references as suggested in the Office Action. 

In the detailed discussion of the obviousness rejection beginning on page 5 of the Office 
Action, it is stated that "as per claims 1, 20, 37, and 46, Asad et aL discloses the invention as 
claimed". As discussed in detail above, however, Asad et aL does not disclose many of the 
features recited in the independent claims 1, 20, 37, and 46. Bisbee et aL similarly fails to 
disclose or suggest at least the above features, and accordingly, the cited references, whether 
taken alone or in combination, fail to disclose or suggest remote notification of records as 
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claimed. The independent claims 1 1 20, 37, and 46 thus patcntably distinguish over the 
combination of Asad et aL and Bisbee et aL By virtue of their dependency from one of the 
independent claims 1 , 20, 37, and 46, the rejected claims 5 to U , 14 to 1 7, 24 to 30, 33 to 36, 40 
to 42, 47, 50 to 51 and 53 to 55 similarly distinguish over the cited references for at least the 
reasons discussed in detail above. 

Claims 14 to 17 and 33 to 36 recite additional features of a notification message or a 
notification. As the cited references fail to disclose any notification of records, these claimed 
features further distinguish claims 14 to 17 and 33 to 36 thereover. 

Thus, as discussed in detail above, the combination of Asad et aL and Bisbee et at, does 
not disclose the features recited in the rejected claims. 

Turning now to the issue of a motivation to combine the teachings of the cited references, 
page 6 of the Office Action states that it would have been obvious to a person having ordinary 
skill in the art to modify the audit record system of Asad et al by combining the secure audit 
tracking system in Bisbee et al using public key cryptography to ensure the validity of an audit 
with a trusted date-time stamp, a digital signature, and authentication certificate, and refers to 
column 4, lines 33 to 42 of Bisbee et aL as providing a motivation to do so. It is not clear from 
the Office Action or the cited references why such a combination would be necessary or even 
desirable- Asad et aL already includes mechanisms for ensuring the integrity of audit records, 
and therefore a person skilled in the art would not perceive any need to modify the Asad et al 
system to provide additional validity or integrity mechanisms. Accordingly, a person skilled in 
the art would not be motivated to combine the references as suggested in the Office Action. 

Reconsideration and withdrawal of the obviousness objection to claims 5 to 1 1, 14 to 1 7, 
24 to 30, 33 to 36, 40 to 42, 47, 50 to 51, and 53 to 55 are respectfully requested. As discussed 
above, there is no motivation to combine the cited references, and even if combined, the cited 
references do not disclose the features recited in the rejected claims* 
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In view of the foregoing, early favorable consideration of this application is earnestly 
solicited. 

Respectfully submitted, 
KAREV1 NATHOO, ET AL 
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